public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 04:34:07 +09:00
Code Issues Packages Projects Releases Wiki Activity
5,003 Commits 106 Branches 177 Tags
581ec5b3a07a7c8cfc16a51289f44b3e2d9a7533
Commit Graph
5003 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kristoffer Dalby 581ec5b3a0 derp: keep node order across map refreshes 
Clients close their home relay when its order changes. SaaS's never moved.
 2026-11-03 17:05:00 +01:00
Kristoffer Dalby 6fe0df64e1 CHANGELOG: note the map field changes 
Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby a7f2c85cfd mapper: send base_domain as the exit node filtered set 
SaaS sends its own domains, which name nothing here. Otherwise an exit node
proxies tailnet names, and where its OS resolver reaches MagicDNS a client
reads its view of the tailnet. MagicDNS only: without it, base_domain can be
public, and clients ask the exit node for its names. Reverse lookups stay
open, as on SaaS.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby ef6d033d19 state, change: send the last seen time in the offline patch 
As SaaS, on every offline patch and no online one. Peers otherwise show no
last-seen time until the next full map. SaaS sends a coarser time; the exact
one here is deliberate.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 5083d77731 mapper: leave online state off a node's own entry 
As SaaS. Clients take their own state from the map poll.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 50be190482 mapper: leave Cap off a node's own entry 
As SaaS. Clients read it from peers only; a client knows its own version.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 7d50f33e32 types: leave MachineAuthorized off peer entries 
SaaS sets it only on a node's own entry, the only one clients read.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 0d5e4f28e9 types: stop sending machine keys in map entries 
Stable identity that outlives node key rotation. SaaS sends it on no entry; no
client from our minimum version on acts on it.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 12de511271 servertest: compare map entry fields with SaaS 
Wire rules from frames, entry fields from a replay, exit node filter by the
names it covers. Known differences listed as skips.

Updates #3626
 2026-11-03 16:29:03 +01:00
Kristoffer Dalby 1986b52983 CHANGELOG: note via applying only to the ip part of a grant 
Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 398223c640 servertest: replay the via grant shapes through the mapper 
Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby f88a24c509 policy/v2: record via grant shapes 
Narrow and subnet sources, app with and without ip, an empty app, and a non-via
primary.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 2c70845bda policy/v2: count a router in a subnet source as a via viewer 
SaaS sends it the via route (via-grant-v83).

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 9fff03f4b5 policy/v2: apply via only to the ip part of a grant 
SaaS treats app as if via were absent: v80 and v84 peer the same, v87 peers a
non-via router, v88 and v91 send the route on the primary. Dropping a via grant
with no ip at compile left grant-k12's nodes with no peers.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby aa7b2ab404 policyutil: send a router no capability for its subnet 
via-grant-v84 and v86 show SaaS sending none.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 3fdedefbf9 policy/v2: link a via grant's sources to its router only 
A rule naming the route also linked a router that is a source to all others
serving it. SaaS does not (via-grant-v81).

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 5642d976b2 policy, state: correct MatchersForNode's doc 
It filters routes. Peers come from BuildPeerMap.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby 5be981ca95 servertest: replay the member-to-subnet routes capture 
Same shape as #3626: the router is in no rule.

Updates #3626
 2026-11-03 15:53:04 +01:00
Kristoffer Dalby aeceef9cce policy/v2: anonymize a public endpoint in older captures 
Recordings since hold only documentation addresses.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 52d6dea601 hscontrol: drop user profiles no node in a capture uses 
A client keeps every profile it was sent; these were never SaaS state.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby ec2e76e7cd servertest: replay ACL captures with auto-approved routes 
Only the policy approves their routes, so broken approval fails the replay.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 7a47710d64 servertest: keep filter sources that name no peer 
They stopped a replay before any comparison; a side lacking one still differs.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby db0b6c9d5d policy/v2: hold source form skips to the same addresses 
A listed check hides any difference, so both filter paths must first match as ranges.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby c59e19be21 policy/v2: check that captures agree on routes 
Parts of a capture are read seconds apart, so an approval can split them.
Also refuses tool failures, lost nodes, unknown peers, lagging viewers and approvals that never landed.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 4671143b8f policy/v2: record again captures split by a route approval 
tscap read approved_routes before the netmaps, and five captures lost a node.
Contiguous new addresses make SaaS and headscale source forms differ, so those checks are listed.
Also moved by recording now: capver 131 to 142, default-auto-update, self RoutableIPs.
 2026-11-03 15:52:58 +01:00
Kristoffer Dalby 8b41925a1f nix: support systemctl reload in the headscale service 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby c7daf6d923 .github: regenerate integration test workflow 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby 021f0294f8 integration: test TLS certificate reload on SIGHUP 
Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby b3ffec4269 hscontrol: reload manual TLS certificate on SIGHUP 
Files that fail to load or are not valid now keep the previous certificate.

Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h
 2026-11-03 15:52:52 +01:00
Kristoffer Dalby 7bd88aee79 .github: exempt milestoned issues from stale bot, stale after 45 days (#3652) 
Milestone means triaged. Close message said 14 days; config is 7.
 2026-11-03 15:52:47 +01:00
github-actions[bot] 2456ba1f6b Update VOUCHED list (#3651) 
https://github.com/juanfont/headscale/issues/3650#issuecomment-6601738938

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-11-03 13:15:31 +00:00
github-actions[bot] 152c7f262b Update VOUCHED list 
https://github.com/juanfont/headscale/issues/3643#issuecomment-6581488242
 2026-11-03 13:51:44 +01:00
Igor Serganov d0e10f2d46 util: read .json files as HuJSON in UnmarshalByExt (#3634) 
dns.extra_records_path and derp.paths files ending in .json were decoded
with encoding/json, so a comment or trailing comma in otherwise valid
JSON made headscale refuse to load the file. Policy files already accept
HuJSON regardless of extension. HuJSON is a superset of JSON, so
standardizing .json input the same way as .hujson keeps every valid JSON
file decoding exactly as before.

Add tests for comments and trailing commas in extra records, in generic
.json decoding and in ACL policies, and for comment markers inside
string values.

Fixes #3627
 2026-11-02 20:35:24 +01:00
Igor Serganov c6723fa103 state: keep collision-bumped GivenName within the DNS label limit (#3635) 
`dnsname.SanitizeHostname` truncates a hostname to 63 characters. When
that label was already taken, resolveGivenName appended "-N" to the
full base, producing a 65+ character GivenName. Such a name is not a
valid DNS label, so the node cannot be rendered into its own netmap
or any peer's, and on PostgreSQL the varchar(63) given_name column
rejects the write.

Trim the base so base plus suffix fits in a DNS label and strip a
hyphen left at the cut. isAutoDerivedGivenName now compares against
the same bump, so a trimmed name still follows hostname changes
instead of being treated as an admin rename.
 2026-11-02 20:28:28 +01:00
Michael Lopez 42a97be25f state: validate the new name and refuse OIDC users in RenameUser (#3642) 
State.RenameUser went through UpdateUser and skipped the checks
db.RenameUser applies, so the API could rename an OIDC user, whose
name the identity provider owns, or rename any user to an invalid
name. Apply both checks in the update function and map the username
validation errors to 400.
 2026-11-02 20:22:23 +01:00
Kristoffer Dalby 697eff7474 CHANGELOG: enumerate policy, lifetime and API compatibility breaks 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4cb74dfe04 policy, servertest: derive exit routes from allowed public destinations 
A public IP permits exit defaults; private-only rules do not. Replay six
accepted and two refused SaaS captures with range-equivalence checks,
preserving provenance and the literal-default-route ACL validation gap.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby f453502ef1 hscontrol: name policy, registration and map delivery decisions 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 9cc0d01026 hscontrol: preserve stale GC timer coverage after ephemeral ownership changes 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4a00488869 mapper: read tracked peers under workMu in batcher tests 
A full map replaces the set with Clear then Store; an unlocked read
between them failed TestOlderInitialMapLeavesNewerStreamsPeers.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 4e946edb08 api/v2: enforce and document OAuth tag permissions 
Retagging requires all current and requested tags; disallowed tags return
400. Token responses list tags only when the token may assign them.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 7d94d189fa api/v2: send empty route lists under fields=all 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 1c65b9f162 gen/client/v2: regenerate for the device's join key 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 66db32dde0 api/v2: report tagged device creators and join keys 
Use the join-key creator as the device's user without changing ownership.
Omit oauthClientId when an OAuth token's source client is not recorded.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby e4396e9f9d gen/client/v2: regenerate for the key list without all=true 2026-11-02 19:15:40 +01:00
Kristoffer Dalby a08daa91fe api/v2: list token-made auth keys to a token without all=true 
Keys an OAuth token makes are marked so. No listing holds an invalid
key.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 060f145ac6 db, types: add a credentials column for keys a token made 
No released version made keys from tokens, so existing rows stay false.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby fe260f5adf api/v2: show userId on admin-made tagged keys 
An admin key's user is recorded as the creator of the tagged keys it
makes. A tagged key re-registers a machine by its tags, whoever made it.
 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 6474ac6dd3 api/v2: return a device name as its FQDN 2026-11-02 19:15:40 +01:00
Kristoffer Dalby 17cbea0f6a api/v2: ignore unknown fields and reject unknown key types 
Match SaaS request decoding while refusing unsupported keyType values.
 2026-11-02 19:15:40 +01:00